eca91dfbd4fd577723ce5fc218d9a5f746db78d30d0f37b2814670b46ab82162 | Triage

Analysis

max time kernel
143s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11-07-2024 20:15

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/OnTop.dll
Size

3KB
MD5

7c0c240e911a521e8e554a10d04e558f
SHA1

d12ca9c464f2764e211039c09e56cb347626f7c7
SHA256

28cf47c05c86b2264ea1da120d3644cb46c86d6f27072a9a853e63e05ec97a25
SHA512

579b6787061efdc7f618f3c5a513cb539ccbe12ca41ba5e9ba8f00d03600edcdd82262b0fbfd58b96231c461f18b1233d657cbd0d1b827ea9df5374508578707

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 3156	2648	rundll32.exe	87
PID 2648 wrote to memory of 3156	2648	rundll32.exe	87
PID 2648 wrote to memory of 3156	2648	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\OnTop.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\OnTop.dll,#1
  2⤵
  PID:3156

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads